International · International Electrotechnical Commission (IEC) / ISA · IEC 62443

IEC 62443 Industrial Automation and Control Systems Security

The international standard series for securing industrial automation and control systems (IACS) across the IT/OT boundary.

What it is

IEC 62443 is a multi-part standard series for IACS cybersecurity. It has four groups: General (62443-1-x), Policies and Procedures (62443-2-x), System (62443-3-x) and Component (62443-4-x). Its key concepts are the zone-and-conduit model, Security Levels (SL 1-4) and the Foundational Requirements. Utilities, manufacturers and OEMs widely use it. It is also an accepted basis for cyber-hazard obligations under Australia's CIRMP Rules.

Who it applies to

Operators, integrators and product suppliers of industrial control systems - electricity, water, oil & gas, manufacturing, transport and building management.

IEC 62443 Industrial Automation and Control Systems Security

Requirements

Risk assessment and system design

Identify zones and conduits and assign Security Levels to each.

Identification and authentication

Identify and authenticate users, software processes and devices.

Use control

Restrict privileges. Limit networked resources to authorised users, software and devices.

System integrity

Protect IACS integrity. This covers input validation, session integrity and malicious code detection.

Data confidentiality

Keep information confidential, at rest and in transit.

Restricted data flow

Segment IACS networks through zones and conduits.

Timely response to events

Respond to security violations through continuous monitoring and forensic capability.

Resource availability

Keep IACS available against degradation or denial of essential services.

Sources

Start with a conversation.

Speak to us about your cyber governance and compliance requirements.

Send us a message

What can we help with?

A sentence or two is plenty. We'll ask for detail when we reply.